Privacy Policy

1. Background

Each and every one of us has control over our personal information.

Looking after your data securely is important to us.

Who Cares? Scotland looks after thousands of people’s information across Scotland: members with care experience, those we support, relevant others, donors and fundraisers, employees, and volunteers.

We take our information management responsibilities very seriously and we safely and securely store all information. We will be open and transparent about the way we hold and use your information. All the data that we gather is managed in strict accordance with the General Data Protection Regulation (GDPR), The Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

These regulations are designed to protect and empower communities.

2. About Who Cares? Scotland

This Website is owned and operated by Who Cares? Scotland.

Who Cares? Scotland is a national voluntary organisation, working with people with care experience across Scotland. We also provide support to children and young people with Additional Support Needs and to those going through the Children’s Hearing System. Our registered charity number is SC026076, and you can contact us at:

Who Cares? Scotland

40 Wellington Street

Glasgow

G2 6HJ

Tel: 0141 226 4441

Who Cares? Scotland’s Evidence & Impact Manager holds data protection responsibilities. She can be contacted if there are any questions about this policy, with any specific questions about any individual’s information, or if you wish to make a complaint. Her contact details are as follows: 0141 226 4441 or mydata@whocaresscotland.org.

If you feel that your data has not been handled correctly, or if you are unhappy with our response to any requests you have made to us regarding the use of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office.

You can contact them by calling 0303 123 1113 or online.

Who Cares? Scotland commits to collect the minimum amount of information we need to interact with you or to provide you with support.

We do not make any decisions based on automated decision making. This means that no decisions will be taken regarding your information without people being involved. We do not make decisions electronically.

We explain our privacy approach to managing people’s personal information in the following sections.

3. Cookies

Cookies are small files which a website sends to your device for a variety of reasons such as to make a website work, or work more efficiently, to improve your experience of using a website and to help the website owner to understand how many visitors they receive and how they are using the site.

When you first access our website, you will be advised that our website uses ‘cookies’ and you will be asked to select which ‘cookies’ / Privacy Level you are happy with:

Private: Highest level of privacy. Data accessed for necessary basic operations only. Data shared with 3rd parties to ensure the site is secure and works on your device.
Balanced experience: Data accessed for content personalisation and site optimisation. Data shared with 3rd parties may be used to track you and store your preferences for this site.
Highest level of personalisation: Data accessed to make ads and media more relevant. Data shared with 3rd parties may be used to track you on this site and other sites you visit.

Your choice will remain in place for one month, and you will be asked to choose again after this time.

4. Information for people receiving Independent Advocacy

Who Cares? Scotland provides independent advocacy to people with care experience and to a range of other children, young people, and relevant adults (such as Kinship carers) via face-to-face services and a dedicated Helpline.

We work individually with people to help them have a say in what is happening to them. We strive to provide independent advocacy that helps people to feel respected, included, listened to, and understood. We also ensure people know what their rights are and how to claim them.

All individuals who are receiving independent advocacy from Who Cares? Scotland will have this Privacy Notice explained to them at the time they start to receive a service. This explanation will cover the following information:

The information we hold about you

Who Cares? Scotland holds personal and sensitive information about you such as your name, address, date of birth, gender, ethnicity, whether you have a disability, and information on people close to you (‘key contacts’), so that we can make sure our support meets your needs.

We may also hold other information about your health, education, any involvement with the justice system, your home situation and details of your care experience, including reports, plans and reviews, e-mails, and information that other organisations may tell us about your situation that helps us to provide you with the most appropriate support.

Your record may also contain photos and copies of work that you have done to express your views.

Why we keep and how we use information about you

We need to know about you to provide you with information and support that can really help you. The personal information we hold about you may be used in the following ways:

to identify if advocacy is needed
to make sure that the support we provide is exactly what you want it to be
to ensure you, those around you, and those you tell us about are safe
to get feedback on the service we provide

Personal information will also be anonymised and collated in a way that cannot be linked to you, so we can:

understand the types of issues and concerns people are approaching us with; this information is shared with our funders and will help inform our wider influencing work
understand if our independent advocacy service is available to all who need it; this information is shared with our funders and will help us to ensure we are as inclusive as possible

How we collect your information

We collect information about you from different people, for example:

directly from you
from your carer, friend or other individual who has sign-posted you to us
from your social worker, school, health provider, or local authority
from other organisations who might be providing you with support

We will only collect information about you that is relevant and needed for us to support you through independent advocacy. It is important therefore, that this information is correct and up to date.

Who might we share your information with?

There are some routine circumstances where we might share your personal information with someone outside the organisation. The most common examples would be:

When someone in receipt of advocacy asks us to pass on their details to assist them in accessing another service. In these cases, we would only share your personal information with your express consent.
If we believe you or someone else might be at risk. We then have a duty to report a safeguarding concern under Child Protection or Adult Support and Protection legislation.

We may also pass on personal data in other urgent or exceptional circumstances. Examples include:

To comply with a court order or request from statutory regulator (e.g., the Scottish Social Service Council – SSSC)
To protect public health, for example to comply with contact tracing during the coronavirus pandemic
When necessary to protect the health, safety and welfare of staff members or volunteers, for example if a member of staff/volunteer does not check in as expected when lone working
To prevent serious physical harm to a person
To protect someone’s vital interests – this refers to life or death situations

Wherever it is possible and reasonable to do so, Who Cares? Scotland commits to consulting an individual about the need to share their information in advance. However, the urgent or exceptional nature of the above circumstances means this may not always be possible.

Storing your information safely and securely

Your information is private. We have a duty to keep it safe. We store your information on a secure computer system. We may also hold some information about you on paper, but we ensure there are appropriate measures in place to guarantee this data remains secure.

Who Cares? Scotland has internal policies and controls in place to try to ensure that your data is not lost, accidentally destroyed, misused, or disclosed, and is not accessed except by its employees or volunteers in the performance of their duties.

Where Who Cares? Scotland engages third parties to process personal data on its behalf, they do so based on written instructions, are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of data.

How long will we retain your information?

We will keep your information in line with good practice and government recommendations.

Currently, we are not destroying any of this information because the Scottish Child Abuse Inquiry is ongoing, and the information we collect may support any claims you may wish to make.

We will usually retain your information for your lifetime or for upto 100 years from your Date of Birth. This means that you can ask to see it in the future.

Archiving

We will also retain information relating to our Independent Advocacy services for archiving purposes in the public interest and/or historical research purposes. Such information may include personal data relating to you (which will mean that your personal data may be held by us for longer periods). Any archiving of information by us will be undertaken in accordance with the National Archives Guide to Archiving Personal Data 2018.

What the law says

The law says that we must:

Collect and use your personal information fairly and lawfully
Keep your information secure
Respect the rights given to you through information laws which include rights that allow you to question, complain, correct, remove, and restrict the information held about you (please discuss with your worker if you have any questions about your rights)
Make sure the information that we hold is adequate, relevant, accurate and up to date

The data protection laws also say we must have a valid lawful basis in order to process your personal information. Who Cares? Scotland will process your information on the lawful basis of legitimate interest. The legitimate interest is the support that we offer you. We would not be able to offer you independent advocacy without processing your personal information. We plan to use your information only in ways that you would expect us to do this, and we expect that our use of your information will have minimum impact on your privacy.

Your right to see the information we hold about you

You have the right to see any information that we hold about you except:

Information that could harm you or someone else
Information about some legal matters such as if a serious crime has been committed
Information that is private to someone else

If you want to see your records, you can speak to a member of staff you know, and they will help you to put your request in writing if needed, or you can contact mydata@whocaresscotland.org directly.

5. Information for people attending groups and enjoying one-off events and activities

Who Cares? Scotland creates safe, valued, and regular spaces for people with care experience and their friends to enjoy fun and friendship with people who have similar or shared experiences, and helps everyone feel understood, respected, and included as part of Scottish communities.

Sometimes these spaces are all about having a good time; on other occasions you might have more serious conversations about topics that affect you with a view to making change happen – we call this participation.

All individuals who attend a group, activity or event organised by Who Cares? Scotland will have this Privacy Notice explained to them at the time they start to engage with us. This explanation will cover the following information:

The information we hold about you

We may also hold other information about your health, home situation, risk assessment, any involvement with the justice system, and details of your care experience that helps us to provide you with the best possible experience.

We may also hold your photograph.

If you get involved with participation activities, your record may also contain photos and copies of work that you have done to express your views.

Why we keep and how we use information about you

We want to provide you with the best possible experience – whether you have signed up for a national event, activities as part of a summer programme, or as a member of a group.

The personal details you share with us when you register for our groups, events or activities will be used in the following ways:

to keep you up to date with the event, activity, or group you have signed up for
to support you at our events, activities, and groups, and to keep you safe
to get your feedback on the event, activity, or group you were a part of, so that we can make our activities even more exciting for you

Personal information will also be anonymised and collated in a way that cannot be linked to you, so we can:

understand the types of activities and events people enjoy attending and develop those that don’t work so well; this information is shared with our funders
understand issues and concerns that are important to people participating in our groups, activities, and events; this information is shared with our funders and will help inform our wider influencing work
understand if our participation activities are available to all; this information is shared with our funders and will help us to ensure we are as inclusive as possible.

How we collect your information

The information we collect about you will come directly from you, when you register for our groups, activities, or events. If you are under 16 (in certain circumstance under 18) or if you find it difficult to tell us the information we need to know, we may need to ask for data from a parent, guardian, or responsible adult.

We will only collect information about you that is relevant / needed for us ensure you are safe and have a great time at our groups, activities, and events. It is important therefore, that this information is correct and up to date.

If you are invited to a participation activity where your views are captured, you will be told before the start what information will be gathered and who will see it. You will then have the choice as to whether you want to be involved or not.

Who might we share your information with?

There are some other routine circumstances where we might share your personal information with someone outside the organisation. The most common example would be:

If we believe you or someone else might be at risk. We then have a duty to report a safeguarding concern under Child Protection or Adult Support and Protection legislation.

We may also pass on personal data in other urgent or exceptional circumstances. Examples include:

To comply with a court order or request from statutory regulator (e.g., the Scottish Social Service Council – SSSC)
When necessary to protect the health, safety and welfare of staff members or volunteers, for example if a member of staff / volunteer does not check in as expected when lone working
To protect public health, for example to comply with contact tracing during the coronavirus pandemic
To prevent serious physical harm to a person
To protect someone’s vital interests – this refers to life or death situations

Storing your information safely and securely

How long will we retain your information?

If you sign up for a single event or activity, we will hold on to the details you give us in the event registration form until one month after the end of the event. We will then delete / securely destroy all identifiable personal and sensitive information.

If you are a member of a group we will hold on to your information until you tell us you want to leave the group, or you stop attending for a period of six-months. We will then delete all identifiable personal and sensitive information.

If you are involved in a participation activity, your information, views, opinions, artwork, photos / other contributions may be shared with people outside the organisation, but this will only be with your prior knowledge and consent. In most cases, any contribution you make would be anonymous – this means that nobody would know that it came from you. Once shared externally, the information that is provided will be difficult to remove. Therefore, we will talk this through with you and make sure you are aware of any risks before any of the information is shared. Who Cares? Scotland will store your participation contributions for a minimum of one year from the date you created it.

Archiving

We will also retain information relating to our groups, activities and events for archiving purposes in the public interest and/or historical research purposes. Such information may include personal data relating to you (which will mean that your personal data may be held by us for longer periods). Any archiving of information by us will be undertaken in accordance with the National Archives Guide to Archiving Personal Data 2018.

What the law says

The law says that we must:

Collect and use your personal information fairly and lawfully
Keep your information secure
Respect the rights given to you through information laws which include rights that allow you to question, complain, correct, remove, and restrict the information held about you (please discuss with your worker if you have any questions about your rights)
Make sure the information that we hold is adequate, relevant, accurate and up to date

The legitimate interest is enabling you to attend the groups, activities, and events that we offer. You would not be able to attend these groups, activities, or events without us processing your personal information. We plan to use your information only in ways that you would expect us to do this, and we expect that our use of your information will have minimum impact on your privacy.

We will get your explicit consent if we want to use your contributions in any participation activity and this consent process will include:

asking you to positively opt-in to the work you will be doing alongside us and regularly renewing this opt-in
giving you the information you need to make a choice about your involvement
explaining the different ways we will use your information and who may be able to access that information
if and where necessary, seeking consent from a responsible adult

In this way, we will:

build a trusting relationship with you based on up-to-date information
help you understand any risks involved, and give you a choice over what you want to do alongside us
make it easy for you to withdraw consent, and tell you how
let you know how we will support you throughout your work with us

Your right to see the information we hold about you

You have the right to see any information that we hold about you except:

Information that could harm you or someone else
Information about some legal matters such as if a serious crime has been committed
Information that is private to someone else

If you want to see your records, you can speak to a member of staff you know, and they will help you to put your request in writing if needed, or you can contact mydata@whocaresscotland.org directly.

6. Information for people supporting our campaigns

Since our inception, Who Cares? Scotland have worked alongside Care Experienced people to campaign for a lifetime of equality, respect and love for all Care Experienced people. We do this in several ways, such as by generating news stories with the press and by creating social media campaigns.

All our campaigning work is informed by the voices and opinions of Care Experienced people and we depend on support from the wider community to make change happen.

The information we hold about you

We will only collect information that enables you to support the campaigns you have indicated you are interested in.

The type of personal details you share with us might include your name, contact details and contact preferences. This information is all held securely.

Why we keep and how we use information about you

As an organisation, we seek to influence the development of legislation, policy and good practice which impacts on the lives of people with care experience.

One of the ways we do this, is by asking people to support our campaigns for change. When you sign up for one of our campaigns, we will use your information to keep you informed about the progress of this campaign and let you know how you can best support our calls for change.

How we collect your information

The information we collect about you will come directly from you when you pledge your support for one of our campaigns.

Who might we share your information with?

We will not share any identifiable personal details with anyone outside of Who Cares? Scotland.

Storing your information safely and securely

How long will we retain your information?

We will hold on to the details you give us when you pledge your support for one of our campaigns until one month after the campaign stops. We will then delete / securely destroy all identifiable personal and sensitive information.

Communicating with you

Being able to communicate with you is important, as it is only with your support that our campaigns will achieve traction. You can, however, choose to stop hearing from us about our campaigns at any time, by phoning 0141 226 4441; or emailing mydata@whocaresscotland.org; or by writing to us at the address below.

My Data

Who Cares? Scotland

40 Wellington Street

Glasgow

G2 6HJ

We will always respond to your wishes in a sensitive, timely and professional manner and we promise not to contact you more than necessary.

What the law says

The law says that we must:

· Collect and use your personal information fairly and lawfully

· Keep your information secure

· Respect the rights given to you through information laws which include rights that allow you to question, complain, correct, remove, and restrict the information held about you

· Make sure the information that we hold is adequate, relevant, accurate and up to date

We have carried out a Legitimate Interest Assessment (LIA) that shows that we use personal data proportionately, our use has minimal impact on privacy, and supporters would not be surprised or likely to object to receiving campaigning information from us.

Your right to see the information we hold about you

You are entitled to access a copy of the information we hold on you.

If you want to see your records, you can contact mydata@whocaresscotland.org.

7. Information for people involved in our public facing work (e.g., media / blogs etc.)

Who Cares? Scotland undertakes a range of public facing work with people with care experience. Together, we lead the way in changing the look and feel of care in Scotland by raising the profile of people with care experience, our rights, and what matters to all of us.

Our influencing work may involve writing blogs for the website, featuring in a magazine or newspaper article, delivering training or public speaking.

The information we hold about you

This will depend on the specific influencing opportunity you take part in but may include personal and sensitive information about you such as your name, address, date of birth, gender, ethnicity, sexual identity, whether you have a disability, and information on people close to you, as these factors are part of your ‘story’.

We may also hold other information about your health, home situation, any involvement with the justice system, and details of your care experience.

We may also hold your photograph.

Why we keep and how we use information about you

As an organisation we seek to influence the development of legislation, policy and good practice which impacts on the lives of people with care experience. We believe that those of us with care experience are the experts in our own lives. That means we have a lot to offer and must be consulted by decision makers.

In order to do this, Who Cares? Scotland supports people with care experience to tell their stories and contribute their views in a variety of ways and in many different spaces.

How we collect your information

The information we collect about you will come directly from you when you agree to take part in an influencing opportunity.

Who might we share your information with?

During drafting stage – before product is released publicly

Whilst Who Cares? Scotland employees are supporting you to write / tell your story or contribute your views as part of an influencing opportunity (i.e., before anything is made publicly available), there are some routine circumstances where we might share your personal information with someone outside the organisation. The most common example would be:

If we believe you or someone else might be at risk. We then have a duty to report a safeguarding concern under Child Protection or Adult Support and Protection legislation.

During this period, we may also pass on personal data in other urgent or exceptional circumstances. Examples include:

To comply with a court order or request from statutory regulator (e.g., the Scottish Social Service Council – SSSC)
When necessary to protect the health, safety and welfare of staff members or volunteers, for example if a member of staff / volunteer does not check in as expected when lone working
To protect public health, for example to comply with contact tracing during the coronavirus pandemic
To prevent serious physical harm to a person
To protect someone’s vital interests – this refers to life or death situations

After product is released publicly

With any media or public facing activity, once shared externally, that is with funders, on the Internet, social media, etc., it is impossible to know who will access the information. Therefore, we will talk this through with you and make sure you are aware of any risks before any of the information goes live.

Storing your information safely and securely

Whilst we are supporting you to write/tell your story or contribute your views as part of an influencing opportunity (i.e., before anything is made publicly available), your information is private. We have a duty to keep it safe. We store your information on a secure computer system. We may also hold some information about you on paper, but we ensure there are appropriate measures in place to guarantee this data remains secure.

Who Cares? Scotland has internal policies and controls in place to try to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by its employees or volunteers in the performance of their duties.

Who Cares? Scotland will retain drafts of any story or contribution you make in our secure online system for a period of three years after you initially produced it. This will make it easier for you to contribute to other influencing opportunities as you may not have to revisit the same topics/issues/events again – you can amend the previous draft.

We will retain any video / audio contribution you make (e.g., for Corporate Training or media/advertising campaigns etc.) for an initial period of one year. We will then ask you, on an annual basis, whether you wish us to securely destroy it or retain it for future use.

Once shared externally, that is with funders, on the Internet, social media, etc., the information that is provided will be difficult to remove. Therefore, we will talk this through with you and make sure you are aware of any risks before any of the information goes live.

Archiving

We will also retain information relating to our public facing work for archiving purposes in the public interest and/or historical research purposes. Such information may include personal data relating to you (which will mean that your personal data may be held by us for longer periods). Any archiving of information by us will be undertaken in accordance with the National Archives Guide to Archiving Personal Data 2018.

What the law says

The law says that we must:

Collect and use your personal information fairly and lawfully
Keep your information secure
Respect the rights given to you through information laws which include rights that allow you to question, complain, correct, remove, and restrict the information held about you (please discuss with your worker if you have any questions about your rights)
Make sure the information that we hold is adequate, relevant, accurate and up to date

asking you to positively opt-in to the work you will be doing alongside us and regularly renewing this opt-in
giving you the information you need to make a choice about your involvement
explaining the different ways we will use your information and story, and who may be able to access that information
providing a clear and simple way for you to tell us you agree to different types of public facing / media work
if and where necessary, seeking consent from a responsible adult

In this way, we will:

build a trusting relationship with you based on up-to-date information
help you understand any risks involved in public facing work, and give you a choice over what you want to do alongside us
make it easy for you to withdraw consent, and tell you how
let you know how we will support you throughout your work with us

Your right to see the information we hold about you

You have the right to see any information that we hold about you except:

Information that could harm you or someone else
Information about some legal matters such as if a serious crime has been committed
Information that is private to someone else

If you want to see your records, you can speak to a member of staff you know, and they will help you to put your request in writing if needed, or you can contact mydata@whocaresscotland.org directly.

8. Information for our Members

Who Cares? Scotland is a membership organisation – owned and governed by those of us with care experience. It is also an organisation that is anchored by the support of thousands of people who have rallied around us to build a movement of change.

The information we hold about you

Who Cares? Scotland holds personal and sensitive information about you such as your name, address, date of birth, gender, ethnicity, whether you have a disability and details of your care experience.

Why we keep and how we use information about you

We want to provide you with the best possible membership experience – whether you have signed up as a Family member or a Friend. The personal details you share with us when you voluntarily sign up as a member, will be used in the following ways:

to keep you up to date with news about the organisation
to inform and invite you to our fun events, information days, fundraising events etc.
to let you know about opportunities to get involved with our campaigns or guide our activities

It will be up to you to decide how you want to be contacted by us and what you want to know about. This way we will ensure that we only let you know about the things you are interested in, in the way you want to hear about them.

Your personal details may also be used:

to support you at our events and activities, and to keep you safe
to send you our quarterly newsletter and a birthday card (if a Family member)

Personal information will also be anonymised and collated in a way that cannot be linked to you, so we can:

understand the make-up of our membership; this will help us ensure our membership offer appeals to as many people with care experience as possible. This information may be shared with our funders.

How we collect your information

We collect information about you, directly from you. This is when you subscribe as a member – either online through our website or face-to-face through our membership forms. If you are under 12 years of age, we ask you involve a parent, guardian, or responsible adult when you complete the membership form.

Who might we share your information with?

We will not share any identifiable personal details with anyone outside of Who Cares? Scotland.

Storing your information safely and securely

How long will we retain your information?

We will contact you every three years to check all your contact details are up-to-date and to ensure you still wish to be considered a member of Who Cares? Scotland.

You can however unsubscribe at any time by emailing membership@whocaresscotland.org and adding ‘Unsubscribe’ in the subject line of your email.

Or by writing to us at the following address:

Membership

Who Cares? Scotland

40 Wellington Street

G2 6HJ

Archiving

We will also retain information relating to our Membership for archiving purposes in the public interest and/or historical research purposes. Such information may include personal data relating to you (which will mean that your personal data may be held by us for longer periods). Any archiving of information by us will be undertaken in accordance with the National Archives Guide to Archiving Personal Data 2018.

What the law says

The law says that we must:

Collect and use your personal information fairly and lawfully
Keep your information secure
Respect the rights given to you through information laws which include rights that allow you to question, complain, correct, remove, and restrict the information held about you
Make sure the information that we hold is adequate, relevant, accurate and up to date

The data protection laws also say we must have a valid lawful basis in order to process your personal information. Who Cares? Scotland will process your information on the lawful basis of legitimate interest. We would not be able to offer you the benefits of membership without us processing your personal information. We plan to use your information only in ways that you would expect us to do this, and we expect that our use of your information will have minimum impact on your privacy.

Your right to see the information we hold about you

You have the right to see any information that we hold about you except:

Information that could harm you or someone else
Information about some legal matters such as if a serious crime has been committed
Information that is private to someone else

If you want to see your records, you can speak to a member of staff you know, and they will help you to put your request in writing if needed, or you can contact mydata@whocaresscotland.org directly.

9. Explainer Videos

We know that policies around data can be a bit confusing or lets be honest boring! But it is important that even our younger members understand what we do to protect their personal information. That is why we have created these two short videos to help explain it as simply as we can.